Your website depends on secrets and on code you did not write. A key in a public file, a poisoned package or a tampered release lets someone act as you without touching your server. Most of these incidents run on a developer or build machine, so the useful question is which credentials that machine could read, and whether they have been replaced.
What matters right now
- OVHcloud's CLI binaries v0.11.0 to v0.15.0 were swapped for malware on 19 October 2026, between 14:47 and 16:21 (UTC+2). OVHcloud's own security advisory says to assume secrets on a machine that ran one are compromised.
- Valid provenance does not mean harmless code. Microsoft's ChainDrop analysis says packages published through a legitimate workflow identity can carry valid provenance.
- Version tags can move. After the March 2026 trivy-action compromise, Aqua's security advisory is the reference for what was affected, and pinning Actions to commit SHAs is the standing fix.
- Push protection can be bypassed. GitHub's push protection documentation describes who can bypass it and what a bypass creates, so a scanner is a guard rail and not a guarantee.
Where to start
- If a file answered when you requested
/.env, start with checking whether your .env file is publicly readable.
- If your logs show bots asking for
/.env and /.git, read the 30-second exposure check.
- If you pushed a secret to GitHub, follow rotate first, clean history second.
- If a breach notice named your provider, use the order and steps for rotating secrets after a breach.
- If someone on your team installed the OVHcloud CLI, see which releases were swapped and what to rotate.
- If your site is built with npm, check whether the ChainDrop worm reached your lockfile, then what build-time malware means for a live site.
- If you maintain GitHub workflows, read how to pin Actions to SHAs and safe pull_request_target patterns.
- If you are choosing a secret scanner, compare Gitleaks and GitHub push protection.
The free scan looks at your site from outside, including exposed .env files, .git folders and keys in shipped bundles. It cannot see your build machines or repositories.